Update dependency com.adobe.testing:s3mock-testcontainers to v5.2.0

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
com.adobe.testing:s3mock-testcontainers	5.1.0 → 5.2.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

adobe/S3Mock (com.adobe.testing:s3mock-testcontainers)

v5.2.0

Compare Source

• Features and fixes
  • feat: Persist per-part checksums uploaded via UploadPart as .partmeta.json sidecar files so that CompleteMultipartUpload can pass without clients re-sending per-part checksums for FULL_OBJECT type uploads. (#​3034)
  • feat: Expose per-part checksum metadata via ListParts (returned in each Part element) and GetObjectAttributes (ObjectParts attribute).
  • feat: Correctly model the S3 checksum type support matrix — COMPOSITE requires per-part checksums in CompleteMultipartUpload; FULL_OBJECT does not.
  • feat: Default ChecksumType is now derived per algorithm when not explicitly specified (CRC64NVME → FULL_OBJECT; CRC32/CRC32C/SHA1/SHA256 → COMPOSITE), matching real S3 behavior.
  • feat: Reject invalid algorithm/type combinations at CreateMultipartUpload with HTTP 400 (COMPOSITE+CRC64NVME, FULL_OBJECT+SHA1, FULL_OBJECT+SHA256).
  • feat: validated all tests in MultipartIT.kt against real S3 backend.
  • feat: S3MockContainer (Testcontainers) now supports the S3 Vectors API. Call withVectors() to activate the vectors Spring profile and connect via the new vectorsHttpEndpoint / vectorsHttpsEndpoint accessors (container ports 9092 / 9193).
  • feat: S3MockContainer (Testcontainers) adds withDebug() to activate the server's debug Spring profile and withSpringProfiles(...) to add arbitrary profiles. Spring profiles now compose (comma-separated, de-duplicated) instead of overwriting, so withVectors(), withDebug(), and withSpringProfiles(...) can be freely combined.
  • fix: x-amz-delete-marker: true is now correctly returned when deleting a versioned object that is itself a delete marker (previously returned false).
  • fix: bucket-owner-full-control canned ACL now correctly grants FULL_CONTROL to the bucket owner (was incorrectly granting READ, same as bucket-owner-read).
  • fix: ListObjectVersions no longer skips objects whose key contains characters requiring URL-encoding — a decoding mismatch caused their version metadata lookup to fail, returning an empty version list for those keys.
  • fix: CompleteMultipartUpload now returns a proper NoSuchUpload S3 error instead of an internal server error when the upload result cannot be resolved.
  • fix: GetObjectLegalHold and GetObjectRetention now correctly return a 404 NotFound when only the other lock type is set on the object, instead of incorrectly returning 200 OK with an empty body.
  • fix: ListObjectVersions now URL-encodes the Delimiter field in the response when encoding-type=url is requested, consistent with Prefix, KeyMarker, and object keys.
  • fix: PutObjectRetention/GetObjectRetention now parse RetainUntilDate with full nanosecond precision instead of truncating to milliseconds, fixing incorrect retention timestamp comparisons.
  • fix: hardened internal per-key locking (bucket/object/multipart/vector stores) against unbounded memory growth and a race that could cause NPEs or double-locking under concurrent access — no observable API change.
  • fix: ListBuckets/ListObjectsV2 no longer leak an entry into an in-memory pagination-state map on every truncated listing that isn't paged through to exhaustion — the "continue after" marker is now encoded directly into the continuation token instead of being tracked server-side, so long-lived servers under sustained listing traffic no longer grow memory unboundedly.
  • fix: PutObject/PostObject/UploadPart no longer leak the request's temp file on disk when a later validation (bucket existence, MD5/checksum mismatch, invalid part number, etc.) rejects the request — the temp file is now always cleaned up, not just on the success path.
  • fix: CompleteMultipartUpload now closes already-opened part-file streams if a later part fails to open, instead of leaking their file descriptors.
  • fix: ListBuckets now rejects a non-positive max-buckets with 400 Bad Request instead of an unhandled exception.
  • fix: removed a log statement that echoed the raw, attacker-controlled Content-MD5 request header, which could be used to forge log entries.
  • fix: GetObject with a Range header no longer risks a 500 Internal Server Error on large objects — range positioning now guarantees an exact skip to the requested start offset instead of relying on InputStream.skip, which is permitted to skip fewer bytes than requested.
  • fix: dropped the unused software.amazon.awssdk:s3 client SDK dependency from the server module (only its checksums, regions, and utils helper classes were ever used) — shrinks the Docker image by removing ~15 transitive jars (Netty/Apache HTTP clients, protocol/model classes) that were never exercised at runtime.
  • fix: Reject negative max-parts and max-uploads multipart listing parameters instead of failing with server errors.
  • fix: ListParts now correctly returns IsTruncated=false and a NextPartNumberMarker equal to the last returned part's number (or 0/the request's part-number-marker when no parts are returned, e.g. max-parts=0) instead of null/incorrectly reporting the page as truncated, matching real S3.
  • fix: ListMultipartUploads with max-uploads=0 now returns an empty, non-truncated page (IsTruncated=false and empty NextKeyMarker/NextUploadIdMarker) instead of incorrectly reporting the page as truncated, matching real S3.
  • chore: replaced the runtime software.amazon.awssdk:aws-crt-client dependency with a pure-JVM Crc64Nvme checksum implementation. The native aws-crt library was only pulled in to compute the CRC64NVME checksum and bundled ~20MB of per-platform native binaries (MQTT, S3, TLS, HTTP) that were otherwise unused — shrinking the executable fat jar from ~54MB to ~34MB (−37%) and removing native-library loading at startup. aws-crt is now a test-only dependency (the AWS SDK chunk-encoder used to build test fixtures still requires it).
  • chore: dropped the software.amazon.awssdk:regions dependency from the server module. It was only used to type the com.adobe.testing.s3mock.store.region config property (default us-east-1), but transitively bundled the entire sdk-core chain (sdk-core, third-party-jackson-core, retries, profiles, json-utils, and several SPIs). The property is now a plain String, shrinking the executable fat jar by a further ~3MB (~34MB to ~31MB). No user-facing change — the region is still configured the same way.
  • chore: Modernized the Docker image build.
    • The hand-written multi-stage Dockerfile and docker buildx shell scripts (and the entire docker module) were replaced by the Spring Boot Maven plugin's build-image goal.
    • The build is using the BellSoft Alpaquita Linux (musl) Cloud Native Buildpacks builder (bellsoft/buildpacks.builder:musl) instead of the default Paketo noble-java-tiny builder, and the jlink JRE is trimmed further (--vm=server drops the unused client/minimal JVMs, --compress=zip-9 shrinks the module layer).
    • fix: S3MockContainer.withVolumeAsRoot(...) now runs the container as root. Because the Buildpacks image runs as the non-root cnb user, writes to a host-owned bind mount previously failed with HTTP 500 on Linux (e.g. in CI) — the container could not write into a directory it did not own.
    • fix: switched the image's GC from ZGC to Serial GC. ZGC's concurrent-collection overhead was too costly at the container's tuned low-memory footprint, causing -XX:+ExitOnOutOfMemoryError-triggered JVM exits under concurrent load (surfacing to clients as Connection reset) — Serial GC's fully-compacting collections reclaim memory more reliably at this heap size.
  • chore: The integration-tests module now starts one S3Mock container per test class via Testcontainers instead of the fabric8 docker-maven-plugin, giving each test class full state isolation.
• Version updates (deliverable dependencies)
  • Bump spring-boot.version from 4.1.0 to 4.1.1
  • Bump software.amazon.awssdk:bom from 2.46.11 to 2.53.2
  • Bump aws.sdk.kotlin:s3-jvm from 1.6.96 to 1.8.32
  • Bump kotlin.version from 2.3.21 to 2.4.10
• Version updates (build dependencies)
  • Bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.10.0
  • Bump com.puppycrawl.tools:checkstyle from 13.6.0 to 14.0.0
  • Bump com.tngtech.archunit:archunit-junit5 from 1.4.2 to 1.5.0
  • Bump digital.pragmatech.testing:spring-test-profiler from 0.1.2 to 0.3.0
  • Bump org.apache.maven:apache-maven from 3.9.14 to 3.9.16
  • Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1
  • Bump org.xmlunit:xmlunit-assertj3 from 2.12.0 to 2.13.0
  • Bump actions/checkout from 7.0.0 to 7.0.1
  • Bump actions/setup-java from 5.3.0 to 5.7.0
  • Bump actions/stale from 10.3.0 to 11.0.0
  • Bump docker/setup-buildx-action from 4.2.0 to 4.3.0
  • Bump docker/setup-qemu-action from 4.1.0 to 4.2.0
  • Bump github/codeql-action from 4.36.2 to 4.37.7
  • Bump ossf/scorecard-action from 2.4.3 to 2.4.4
  • Bump step-security/harden-runner from 2.19.4 to 2.21.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.